The following is a guest article by Andrii Klepak, Healthcare Technology Founder and DevSecOps Engineer at CloudCare Pro
In May 2026, Chief Healthcare Executive reported what cybersecurity professionals have been seeing for two years. Small hospitals and clinics have emerged as the primary targets of healthcare cyberattacks in the United States. These are not the headline victims in eight-figure ransomware stories. They are the quiet collapses. The solo dermatologist who loses her patient records and never recovers. The five-clinician behavioral health practice that closes after a phishing campaign drains the operating account. The dental office that pays the ransom because the alternative is bankruptcy.
Attackers have followed the money where the defenses are thinnest, and small healthcare providers have been left to defend themselves with budgets that would not fund a full week of incident response at a regional hospital.
Why Small Clinics Became the Target
A 2024 HHS Office for Civil Rights report documented a sharp increase in breaches affecting fewer than 500 individuals, the category that captures most small-practice incidents. The economic logic on the attacker side is straightforward. A 200-bed hospital has a SOC, a CISO, threat-intelligence feeds, a hardened backup architecture, and a legal team. A solo dermatology practice has a front-desk manager who also handles password resets. Both are subject to identical HIPAA Security Rule obligations under §164.306. Only one is positioned to actually meet them.
Three structural reasons drive this trend. Software fragmentation – a typical small practice runs five or six unintegrated vendor products, each a separate attack surface. “HIPAA-compliant” claims at the vendor layer that do not survive scrutiny. And the absence of any internal cybersecurity capacity at the practice itself. Small practices with fewer than ten staff typically have annual security budgets below twenty thousand dollars, total. That is not a posture. That is a wish.
What We Did at a 49-Pharmacy Network During Wartime
For six years, I was the lead infrastructure engineer for a 49-location pharmacy network operating across four regions of Western Ukraine. In December 2021, the network began migrating its entire IT operation from on-premises servers to public cloud infrastructure. Within ten weeks of the project’s start, Russia invaded Ukraine. The most intense phase of that migration production cutover, electronic-prescription integration, identity federation, verified-restore backup testing – happened through February and March 2022, in the hot phase of the invasion. The migration completed that spring.
The pharmacies stayed open. The electronic-prescription system kept working. One million citizens who depended on that network for essential medication were able to fill scripts in the safer west because the data had been moved out of buildings that were now sometimes being shelled. American small clinics are not being bombed. The structural problem is similar in a way that has been difficult to unsee. Critical healthcare services depend on infrastructure that the people running it cannot afford to defend.
Five Disciplines a Small Practice Actually Needs
First, federated identity. The practice runs on one identity provider with single sign-on, and every staff login has two-factor authentication. Revoking access for a former employee takes one click, not a tour of every separate vendor portal. HIPAA §164.312(a) requires access control. In practice, that means an SSO provider, not Post-it notes on the front-desk monitor.
Second, encryption that can be verified, not just encryption that is claimed. Data at rest needs to be encrypted with keys that the practice or its Business Associate vendor actually controls. Data in transit needs TLS 1.2 or higher. The verifiable test is to ask the vendor in writing where the encryption keys live and who has access.
Third, a real audit log. The regulation expects evidence of which user accessed which patient record and when. Many vendor logs record only authentication events. Ask the vendor for the audit trail of every read of a single patient record over the past 90 days. If the answer is logins but not record-level access, that vendor is not aligned with §164.312(b). The next generation of audit logs is cryptographically hash-chained – altering a historical entry visibly breaks the chain.
Fourth, a Business Associate Agreement that covers the actual workflow. If an AI scribe sends patient data to a third-party model provider, there must be a BAA covering that flow. There almost never is at the small-practice tier. The defensible workaround is strict PHI redaction at the practice boundary, so the model provider never sees protected information and therefore is not a Business Associate at all.
Fifth, a backup strategy that has been tested. Ransomware against small healthcare is profitable precisely because the backups, when they exist, have not been verified. The minimum is daily backups, stored separately, encrypted, and restored in a tabletop test at least once per year. The tabletop is non-negotiable.
Five Questions Every Small-Practice Owner Should Send to Every Vendor
Most security failure in small healthcare originates at the vendor layer rather than the practice layer. The practical leverage point is the vendor relationship. Five matters every small-practice owner should confirm in writing before signing or renewing any software contract: whether a current signed Business Associate Agreement exists and whether a copy can be sent; where the encryption keys for patient data are stored and who can access them; whether the audit log can produce every read of a single patient record over the past 90 days; whether any AI feature is covered by a BAA or PHI is redacted before transmission, or both; and what the contractual breach-notification obligation and timeline are. A vendor that cannot answer in writing is not HIPAA-aligned.
The fix for U.S. small-practice security is not enterprise security at enterprise prices. It is the discipline of multi-account isolation, of verified encryption, of real audit logs, of honest BAA coverage, and of restored backups. These disciplines existed before the war, which taught me what catastrophic infrastructure failure looks like. They are now the table stakes for any healthcare practice that intends to be operating in five years. (I have previously written about the foundational DevSecOps practices small clinics can adopt.)
Andrii Klepak is a Healthcare Technology Founder and DevSecOps Engineer based in Hoffman Estates, Illinois. He is the Founder of CloudCare Pro, a healthcare-software company building HIPAA-aligned tools for small U.S. clinics. He led the cloud-infrastructure migration described in this article from December 2021 through spring 2022. He is an AWS Certified Solutions Architect, a Certified Kubernetes Administrator, and a member of HIMSS and ACM. Connect with him on LinkedIn.
No comments:
Post a Comment